Hi
How about recycle (down + up) fallback route when your primary is up? This would invalidate existing too? forcing switch to primary.
Re: WAN2 doesnt switch to WAN1 (failover)
The commands are already in the script above 
Not sure if ":delay 1;" is needed, but won't hurt.
Code: Select all
/tools netwatch add comment=Provider1 host=8.8.8.8 down-script="/ip route set [find distance=10] disabled=yes" up-script="/ip route set [find distance=10] disabled=no; /ip route set [find distance=11] disabled=yes; :delay 1;/ip route set [find distance=11] disabled=no"
/tools netwatch add comment=Provider2 host=8.8.4.4 down-script="/ip route set [find distance=11] disabled=yes" up-script="/ip route set [find distance=11] disabled=no"
Re: WAN2 doesnt switch to WAN1 (failover)
:delay 1 = sleep for 1 second
What you're seeing now is side-effect of disabling "Providerd 2" route. Netwatch will think the link is lost and will also start suspending the routes...
disable netwatch for Provider2 in meantime:
So on Proivder1 up:
1. re-enable route
2. suspend netwatch route2
3. disable route2
4. enable route2
5. resumte netwatch route2
What you're seeing now is side-effect of disabling "Providerd 2" route. Netwatch will think the link is lost and will also start suspending the routes...
disable netwatch for Provider2 in meantime:
Code: Select all
/tool netwatch add comment=Provider1 host=8.8.8.8 down-script="/ip route set [find distance=10] disabled=yes" up-script="/ip route set [find distance=10] disabled=no; /tool netwatch disable [find comment=Provider2]; /ip route set [find distance=11] disabled=yes; :delay 1; /ip route set [find distance=11] disabled=no; /tool netwatch enable [find comment=Provider2]"
/tool netwatch add comment=Provider2 host=8.8.4.4 down-script="/ip route set [find distance=11] disabled=yes" up-script="/ip route set [find distance=11] disabled=no"
1. re-enable route
2. suspend netwatch route2
3. disable route2
4. enable route2
5. resumte netwatch route2
Re: WAN2 doesnt switch to WAN1 (failover)
Did you copied the lines for routing from somewhere? They don't match together... Some clean-up is suggested.
1. VPN client has it's own routing, hence it will not fail-over with the netwatch config.
add distance=1 gateway=VPN_Client routing-mark=vpn
2. VPN backup is using different mark. Why is that? It means that packets need to be marked differently by firewall for fail-over.
add disabled=yes distance=2 gateway=VPN_BackUp routing-mark=vpn_backup
3. route for ISP2 with only outgoing interface(no next-hop). why is it defined?
add distance=2 gateway=ether7_WAN (GW2-ISP2)
4. additional route for ISP2 is defined with lower distance (=higher priority) but disabled. why?
add disabled=yes distance=1 gateway=192.XXX.XX.X (GW2-ISP2)
5. routings specific for the netwatch are disabled, so all goes over 1 connection
add disabled=yes distance=1 dst-address=8.8.4.4/32 gateway=192.XXX.XX.X (GW2-ISP2)
add disabled=yes distance=1 dst-address=8.8.8.8/32 gateway=192.XXX.X.X (GW1-ISP1)
So:
* vpn fail-over will not work indeed (if using these markings), and that's a separate issue
* you need to enable routings for 8.8.8.8/.4.4
1. VPN client has it's own routing, hence it will not fail-over with the netwatch config.
add distance=1 gateway=VPN_Client routing-mark=vpn
2. VPN backup is using different mark. Why is that? It means that packets need to be marked differently by firewall for fail-over.
add disabled=yes distance=2 gateway=VPN_BackUp routing-mark=vpn_backup
3. route for ISP2 with only outgoing interface(no next-hop). why is it defined?
add distance=2 gateway=ether7_WAN (GW2-ISP2)
4. additional route for ISP2 is defined with lower distance (=higher priority) but disabled. why?
add disabled=yes distance=1 gateway=192.XXX.XX.X (GW2-ISP2)
5. routings specific for the netwatch are disabled, so all goes over 1 connection
add disabled=yes distance=1 dst-address=8.8.4.4/32 gateway=192.XXX.XX.X (GW2-ISP2)
add disabled=yes distance=1 dst-address=8.8.8.8/32 gateway=192.XXX.X.X (GW1-ISP1)
So:
* vpn fail-over will not work indeed (if using these markings), and that's a separate issue
* you need to enable routings for 8.8.8.8/.4.4
Re: WAN2 doesnt switch to WAN1 (failover)
Basis of your netwatch functionality are the selective forwards for 8.8.... ip's. These need to work first.
8.8.8.8 has to always go over isp1, .4.4 over isp2, independent of the fact of the link is up or not => if not up it needs to fail
Do you get that behaviour? ISP up => ping ok, ISP down => ping nok
8.8.8.8 has to always go over isp1, .4.4 over isp2, independent of the fact of the link is up or not => if not up it needs to fail
Do you get that behaviour? ISP up => ping ok, ISP down => ping nok
Re: WAN2 doesnt switch to WAN1 (failover)
Your points:
1. that's for later, the switch over, lets get routing & detection right first
2. so the detection is not working correctly, as 8.8.8.8 gets routed over ISP2 => needs to be fixed
3. for later
So to get routing right:
This should ensure that your detection is consistent. Test it for both, by failing one of the two, and verifying with ping to both. One ping should work, other should fail.
Once confirmed, the previous routes should be removed:
1. that's for later, the switch over, lets get routing & detection right first
2. so the detection is not working correctly, as 8.8.8.8 gets routed over ISP2 => needs to be fixed
3. for later
So to get routing right:
Code: Select all
# Fixed route definition
/ip route
add distance=2 routing-mark=testwan type=blackhole
add distance=1 dst-address=8.8.4.4/32 gateway=192.2.2.2 routing-mark=testwan (isp2)
add distance=1 dst-address=8.8.8.8/32 gateway=192.1.1.1 routing-mark=testwan (isp1)
# Testwan addresses
/ip firewall address-list
add address=8.8.8.8 list=testwan
add address=8.8.4.4 list=testwan
# Testwan route markings to use defined route table
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address-list=testwan new-routing-mark=testwan \
passthrough=yes
Once confirmed, the previous routes should be removed:
Code: Select all
add comment=ISP2_check_host distance=1 dst-address=8.8.4.4/32 gateway=192.XXX.XX.X
add comment=ISP1_check_host distance=1 dst-address=8.8.8.8/32 gateway=192.XXX.X.X
Re: WAN2 doesnt switch to WAN1 (failover)
If you want reliable connection, don't force switch-over. New connection will go over primary when it becomes available, exiting will continue as is, until they close.
Re: WAN2 doesnt switch to WAN1 (failover)
I understand your dilemma. The behaviour is caused by route caching, which the vpn connection is refreshing and hence keeping in cache.
What you could try as a bit more drastic approach: recycle the isp2 interface when isp1 comes up. That should force route cache flush.
What you could try as a bit more drastic approach: recycle the isp2 interface when isp1 comes up. That should force route cache flush.
Code: Select all
/tool netwatch
add comment=Provider1 down-script="/ip route set [find distance=10] disabled=yes" host=8.8.8.8 interval=15s \
timeout=500ms up-script="/ip route set [find distance=10] disabled=no; /tool netwatch disable [find comment=Prov\
ider2]; /interface ethernet disable <ether isp2>; :delay 1; /interface ethernet enable <ether isp2>: \
/tool netwatch enable [find comment=Provider2]"
Re: WAN2 doesnt switch to WAN1 (failover)
the <> are just place holders for you to replace with the right names
Example
Example
Code: Select all
/interface ethernet disable ether1;
Re: WAN2 doesnt switch to WAN1 (failover)
Hello All,
My problem is quite basic, yet i'm stuck. Attempted to set up WAN1 to WAN2 failover with automatic switch to WAN1 when back online. I understand that links established on WAN2 are not reset, as when WAN1 goes offline all the links collapse and WAN2 establishes new ones, however, when WAN2 is still active and WAN1 comes back online, the links are not reset, so I'm stuck with traffic still going through WAN2 and some WAN1 for the new links. Can any help me with my config on how to force WAN2 to reset after WAN1 comes online. I used the following config:
Does anyone has any idea on how to resolve it or approach it another way?Code: Select all/ip route add dst-address=8.8.8.8 gateway=<ISP1 gateway> /ip route add dst-address=8.8.4.4 gateway=<ISP2 gateway> /tools netwatch add comment=Provider1 host=8.8.8.8 down-script="/ip route set [find distance=10] disabled=yes" up-script="/ip route set [find distance=10] disabled=no" /tools netwatch add comment=Provider2 host=8.8.4.4 down-script="/ip route set [find distance=11] disabled=yes" up-script="/ip route set [find distance=11] disabled=no"
just use different distance (priority with lower number) with check-geteway by ping or arp, without scripts
Code: Select all
/ip route
add check-gateway=ping distance=1 gateway=<ISP1_Gateway_IP>
add check-gateway=ping distance=2 gateway=<ISP2_Gateway_IP>
Re: WAN2 doesnt switch to WAN1 (failover)
try the command in terminal to verify
Re: WAN2 doesnt switch to WAN1 (failover)
Yeah... I did, but it doesn't really work, as I have VPN client and the tunnel get hung up on WAN2.. ready above. I like simple solutions but this is not the case here.
dose vpn client the default gateway after established tunnel ?
Re: WAN2 doesnt switch to WAN1 (failover)
You said the fail-over was working before, hence I've taken your word for it.
So now it's clear that netwatch is able to detect lost link, but is unable to do anything about that.
Default routes can't be modified or disabled. Create your own then:
0. disable both netwatch configs
1. remove paths for google dns, these will be added dynamically below
2. define script for dhcp client for both WAN1 & WAN2
!!! UPDATE THE FIRST 3 LINES FOR WAN2 !!! => WAN2, 11, 8.8.4.4
3. Disable "Add Default Route" on your dhcp client in WinBox for both interfaces (WAN1 & WAN2)
4. Disable / enable dhcp client for each interface and verify that both route have been created for each interface: default + 8.8.
5. for netwatch of Provider1, try first disabling route only and not the whole interface. Now that routes will be actually disabled, that might be enough.
So now it's clear that netwatch is able to detect lost link, but is unable to do anything about that.
Default routes can't be modified or disabled. Create your own then:
0. disable both netwatch configs
1. remove paths for google dns, these will be added dynamically below
Code: Select all
distance=1 dst-address=8.8.4.4/32 gateway=192.2.2.2 routing-mark=testwan (isp2)
distance=1 dst-address=8.8.8.8/32 gateway=192.1.1.1 routing-mark=testwan (isp1)!!! UPDATE THE FIRST 3 LINES FOR WAN2 !!! => WAN2, 11, 8.8.4.4
Code: Select all
{
:local label "WAN1";
:local distance 10;
:local pingadr 8.8.8.8/32
:local count [/ip route print count-only where comment=$label]
:if ($bound=1) do={
:if ($count = 0) do={
/ip route add distance=$distance gateway=$"gateway-address" comment=$label
/ip route add distance=1 dst-address=$pingadr gateway=$"gateway-address" routing-mark=testwan
} else={
:if ($count = 1) do={
:local test [/ip route find where comment=$label]
:if ([/ip route get $test gateway] != $"gateway-address") do={
/ip route set $test gateway=$"gateway-address"
/ip route set [find routing-mark=testwan dst-address=$pingadr ] gateway=$"gateway-address"
}
} else={
:error "Multiple routes found"
}
}
} else={
/ip route remove [find comment=$label]
/ip route remove [find routing-mark=testwan dst-address=$pingadr ]
}
}
4. Disable / enable dhcp client for each interface and verify that both route have been created for each interface: default + 8.8.
5. for netwatch of Provider1, try first disabling route only and not the whole interface. Now that routes will be actually disabled, that might be enough.
Re: WAN2 doesnt switch to WAN1 (failover)
Please also add this one, for proper marking of packets leaving router itself
Code: Select all
/ip firewall mangle
add action=mark-routing chain=output dst-address-list=testwan new-routing-mark=testwan \
passthrough=yes
Re: WAN2 doesnt switch to WAN1 (failover)
please can you answer my question
do you need wan fail over for vpn tunnel only?
if so, remove all default gateway in ip route table and use this only
then configure vpn client as attached screenshot,specify username and password and vpn server ip, with default route distance=1
do you need wan fail over for vpn tunnel only?
if so, remove all default gateway in ip route table and use this only
Code: Select all
/ip route
add check-gateway=ping distance=2 dst-address=<VPN_Server_IP> gateway=<ISP1_Gateway_IP>
add check-gateway=ping distance=3 dst-address=<VPN_Server_IP> gateway=<ISP2_Gateway_IP>
then configure vpn client as attached screenshot,specify username and password and vpn server ip, with default route distance=1
You do not have the required permissions to view the files attached to this post.
Re: WAN2 doesnt switch to WAN1 (failover)
Hi ADahi,
What I need is WAN1 to WAN2 failover and after WAN1 comes back online for all the traffic to move back to WAN1. We tried the distance approach, however, we also have VPN_Client and when traffic moves to WAN2 as WAN1 is disconnected, it creates new connections which don't reset when WAN1 comes back online and that the issue we're trying to resolve.
vpn client on same router itself?
or forward through router?
Re: WAN2 doesnt switch to WAN1 (failover)
Hi ADahi,
What I need is WAN1 to WAN2 failover and after WAN1 comes back online for all the traffic to move back to WAN1. We tried the distance approach, however, we also have VPN_Client and when traffic moves to WAN2 as WAN1 is disconnected, it creates new connections which don't reset when WAN1 comes back online and that the issue we're trying to resolve.
We have multiple LANs... some are on VPN_client tunnel, others are just direct WAN connections... so I need the ability to move traffic along with other LAN traffic from WAN to WAN being WAN1 primary and WAN2 4G
aha got it
it is easy
you have to mark every lan
suppose you have lanwan_routemark and lanvpn_routemark
Code: Select all
/ip route
add distance=1 gateway=<vpn_gateway> routing-mark=lanvpn_routemark
add distance=1 gateway=<ISP1_Gateway_IP> routing-mark=lanwan_routemark
add distance=1 gateway=<ISP2_Gateway_IP> routing-mark=lanwan_routemark
add check-gateway=ping distance=2 dst-address=<VPN_Server_IP> gateway=<ISP1_Gateway_IP>
add check-gateway=ping distance=3 dst-address=<VPN_Server_IP> gateway=<ISP2_Gateway_IP>
and do not forgot uncheck "Add Default Route" in vpn client window
Re: WAN2 doesnt switch to WAN1 (failover)
Today my internet connection is too bad, sorry 